9f23df054570cf94a0fe1efe0fae1f6e7b2f66fdbd2700bb42c49c5e23214bbb

Analysis

max time kernel
135s
max time network
135s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
30/09/2023, 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

microsoft.html
Size

4KB
MD5

e7d7da7348886daf9848f9a903f3cdf5
SHA1

75f7a459cd2695a2c749af7c2cfe06648d30ffb2
SHA256

437682d7aed87913869e30288646cd56f35e10da37afd12612ad1322c3b4ad17
SHA512

cb46fbc812f49f44974da6a243c9c70b8908a5d1df6b3b17c660d01450e9aa488ae60834c3bc288a805e76a2531256e9cde57b1dd6c80dfbf1913acadf0402db
SSDEEP

96:DtlHily5pXyKAWlT4vrxhEg3ctxBBJhyDXqfGGDXojF7:vHilyzXyK1Urxt3mxRh43jd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf812000000000200000000001066000000010000200000004dabc6caa24193f55fc80200c0eca4f9aeff2cd6c9b198ff6d02f8d3d28eb26d000000000e8000000002000020000000687fee54ecd93346ab4298b98fc7541e2df314a47eed34535dfa39b359a9e3e8900000004e3c56cf1bbceb9e9da6bb2bb2b3f8c45b8ab2b95766ca71be3589d91c4307097981758f3aafea9bc51ac67e01d11197aa4b2636292f1eba6282cef6a18a124f22d476ce5f76bb5cd82d6e4c2eb392b22843ffb48596918d0652c99838f2331b527cb60e1124f6bc5baa0a8d6166a2da00e648fdb12448ede91b60690450713fdbb01006760d189f987c56fe01434a1240000000679149ac2635abedc08d04d8f7647d43a8f13ab3073cc9c640200a30c01f0feaffcddf5f74ac768d0c8a5f789e16d5e8f883f56a6024ae1a0aad4d6cbd88bd85	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402202314"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F5B8FF71-5F37-11EE-B77D-5A71798CFAF9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf8120000000002000000000010660000000100002000000037cd2c1213c4bbd93178977e662fa237e19631c8632d82ad23788fe50a822aa4000000000e80000000020000200000002cb0ee3d4c9b4db5446f5e37439b18039a928fc5d7f7e742ef9d3462604f7f5020000000f649be0916f4dc834f8a88ba1039690984e951807e729e02c14fe189eb21d4bf4000000086cdcfc12c5c0a7dce8169a2bc9cec37ab02aa413645ff2b9fb9c03cc38a58c3edcb771e965ebc32d267a85287ed12d6536c0cde18fc693362b36e910beedee3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 804457cb44f3d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2808	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2808	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2808	iexplore.exe
2808	iexplore.exe
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2644	2808	iexplore.exe	28
PID 2808 wrote to memory of 2644	2808	iexplore.exe	28
PID 2808 wrote to memory of 2644	2808	iexplore.exe	28
PID 2808 wrote to memory of 2644	2808	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\microsoft.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2808 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cbbc58b1a8874bb6a1cad03f4314f2d

SHA1
6b3d24516d384bbbe0bf031f6d626869596f36d2

SHA256
3c3201ad3c1fed885887f388f34a8954fdb49c9461e9716ca707cedb30ec7de0

SHA512
1ac896d59602c1f6868d798b888bda9504b6f9895febd1ada82611ef4d1aaacad239332c3e4d4b43cc54d1d07f9e93da2e9a4c8939bc8bd276ebabdc72266c8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bd02b6eead28c48b849ec157c92132f

SHA1
2921400cac07bccf687c25599d96e644981567b0

SHA256
ed465cff5648917b63f7c9d3444a3944bdda2ceec0a028cd124312f506cc5870

SHA512
8a923467704de4d6cca824c6ff93bfb1537520d6034364f3e10b8b67c71fa441295c8786580b2d630f8516323e609f29a3517466332de205bd84f321f860469f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e52694a93ff022c7f311e77e35d66244

SHA1
ff9ee2728666ac06103ea9de0f4692739e229b09

SHA256
f8991b37d6d8cf6899a7de2a2c4cdbcf08b90ebcc8dd2440cae296b1785ccef0

SHA512
810f3da00507a225dda968d0fa383edef8f7304d21ebc0e5edb7420efbb5a9c0640a0ae5897b84ac90a136e08f4254d1c8bf98a5ce257a96b6280ba9c3786cf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1421d746495948407c5d4f96ff34a50e

SHA1
63f441fb0c598980d1037c0a33cd4385a0217df0

SHA256
21f00cfed6d1e07f46ccb9c9abd9ff1cf48d76a2951a8f16e47f24f8a18e85b2

SHA512
ebb000ab5d16646e1ad6223c79b0ca7496ed6d8e21e7b484a4569975ced2439a2238a0c4e96babba65c279064fcc945708e1f0b97d07194215f2bcd2581c6b85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e1d8885945d379b7396834face55900

SHA1
2e99511c4838229756d5176ed213a719659d6bca

SHA256
0fcb56b9e9257e1ff463093e5da242cab1698c92f9d601c3d0715b4f3ca0d42c

SHA512
2ef6f28eded068b55728a67d25ecfb6de06b7d2cf4682484a18486bbaf5650c83a8ee3d3db08570d1a037990a89b97bc42dd01697a2f765b7408fa1b2ec5dce7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c8372653f8311530b69ab4f897bc8a6

SHA1
165db0e6b4b9446d7903201b5886a1844463477d

SHA256
d52cca5ec88fb247e8401ffb43f8d3c986659993a23d75793b3889f49dd00761

SHA512
d93d97ad3b7eff3d330da4519069d18d8bf04ca590529766d4e3fdb8124838c31339cd8b3d170dd9a742a05eb1697c0891c46f3cc77fa5c96bfff2d215cfebb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
190f6577289f64b055b30635c5102eb2

SHA1
8eb9aa5a049c48fc4f52370a377407441979aeee

SHA256
f037ba6fa5871595d5e8190e91bb9e0106d5bc69022c080b616f5b2db4fcdac1

SHA512
b2112e657c47afa58a0ae57b9a0627185f590493157848ab4364125ae30ef77c632533009f9924c7d821a063644d71f4604c85c9b07f99215252f7f668de4355

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02ed2f04a2a39756efaab8ab1bd19c25

SHA1
d5ae598cfdf59e4cdfe16a8062d6f45e06b1a562

SHA256
78e8f11085e77367f2380951310e45ac0506f8cabebf515c0d0fe113491c7225

SHA512
8091a2fbacd6f55ef759da3b2c95ae163625bbbdf566013471d924faf58861def4ad2002c868a711f5f20be70f565039b4057023993f9c57ca7ab0c49955a4a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc78c031708fbc347f4bf0e9cc6a6916

SHA1
7fa74965469c27ba0448a5817d3c3be159903b2e

SHA256
623424052b1ce481e01b031ff156a358d2d943c3f01a49a33de316b30e4a60e5

SHA512
9ff70c3b35793724ff0ba1ed02a98b469823d2d65e9e699ee1817392798dc87009b54d77ff49ae67fe039b83b8cb8a5e8b7335851e715acdd2750d16bb724c97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8B52.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8BA3.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit